@intentius/chant 0.46.0 → 0.49.0

package/src/lint/receipt-checks.ts

@@ -0,0 +1,93 @@
+import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
+import { isEffectReceipt } from "../effect-receipt";
+import { isSensitiveKey } from "../deep-observation";
+import { isResourceDeclarable } from "../declarable";
+
+/**
+ * COR023: Receipt Materializes Into a Plain Store (#1833, epic #1703)
+ *
+ * A receipt's materialization target must be a plain store — never a
+ * SecureString, a Secret, or any secret-capable kind. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest,
+ * ../effect-receipt.ts), not a secret: parking it in a secret-capable store
+ * invites masking, rotation, and access-control semantics that defeat the
+ * observe-and-compare loop the receipt exists for, and quietly teaches
+ * readers that the value is sensitive when it must never be.
+ *
+ * This is the honest core half of the guard. Core recognizes receipts
+ * lexicon-independently through the marker (#1831) but cannot know what any
+ * lexicon's kinds mean, so it checks the two signals it does have, both
+ * reusing the secret-kind knowledge core already carries
+ * (SENSITIVE_KEY_PATTERNS, ../deep-observation.ts):
+ *
+ *  - the materialized `entityType` names a secret-capable kind
+ *    (`K8s::Core::Secret`, `AWS::SecretsManager::Secret`, ...);
+ *  - the declared props select a secret-capable variant of an otherwise
+ *    plain kind (a `Type`/`Kind` prop whose value matches secret/secure —
+ *    SSM's `Type: "SecureString"` is the canonical case).
+ *
+ * The concrete per-kind enforcement is each materialization row's job — the
+ * aws row (#1835) pins SSM to plain `String` at the source.
+ */
+
+/** Prop names that select a store variant. */
+const VARIANT_PROP = /^(type|kind)$/i;
+/** Variant values that make the store secret-capable. */
+const SECRET_VARIANT = /secret|secure/i;
+
+export const RECEIPT_PLAIN_STORE_CHECK_ID = "COR023";
+
+const receiptPlainStoreCheck: PostSynthCheck = {
+  id: RECEIPT_PLAIN_STORE_CHECK_ID,
+  description:
+    "An effect receipt's materialization target must be a plain store — never a secret-capable kind or variant",
+  check(ctx) {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [name, entity] of ctx.entities) {
+      if (!isEffectReceipt(entity)) continue;
+
+      if (isSensitiveKey(entity.entityType)) {
+        diagnostics.push({
+          checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+          severity: "error",
+          entity: name,
+          lexicon: entity.lexicon,
+          message:
+            `Effect receipt "${name}" materializes into secret-capable kind "${entity.entityType}" — ` +
+            `a receipt's target must be a plain store. The receipt value is a witness ` +
+            `(an existence marker or a sha256 digest), not a secret; a secret-capable store adds ` +
+            `masking and rotation semantics that defeat the receipt's observe-and-compare loop.`,
+        });
+        continue;
+      }
+
+      if (isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null) {
+        for (const [key, value] of Object.entries(entity.props as Record<string, unknown>)) {
+          if (VARIANT_PROP.test(key) && typeof value === "string" && SECRET_VARIANT.test(value)) {
+            diagnostics.push({
+              checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+              severity: "error",
+              entity: name,
+              lexicon: entity.lexicon,
+              message:
+                `Effect receipt "${name}" (${entity.entityType}) declares ${key}: "${value}" — ` +
+                `a secret-capable store variant. A receipt's target must be a plain store; ` +
+                `use the plain variant (e.g. SSM Type: "String") so the witness value stays ` +
+                `readable to the observe-and-compare loop.`,
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  },
+};
+
+/**
+ * Core's own post-synth checks over effect receipts, run by `chant build`
+ * over the full build result (plugin checks are lexicon-scoped; receipts are
+ * recognized by marker, so this set is deliberately not).
+ */
+export function coreReceiptChecks(): PostSynthCheck[] {
+  return [receiptPlainStoreCheck];
+}

package/src/lint/rules/cor022-receipt-leaf.test.ts

@@ -0,0 +1,116 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor022ReceiptLeafRule, collectReceiptVariables } from "./cor022-receipt-leaf";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("COR022: effect receipt is a leaf (#1833)", () => {
+  test("rule metadata", () => {
+    expect(cor022ReceiptLeafRule.id).toBe("COR022");
+    expect(cor022ReceiptLeafRule.severity).toBe("error");
+    expect(cor022ReceiptLeafRule.category).toBe("correctness");
+  });
+
+  test("flags a property access on a receipt inside another declarable", () => {
+    const ctx = createContext(`
+      export const seeded = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const app = new Service({ marker: seeded.effect });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR022");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain('"seeded" is an effect receipt');
+    expect(diags[0].message).toContain('"effect"');
+    expect(diags[0].message).toContain("sole writer");
+  });
+
+  test("const indirection fires: const r = EffectReceipt(...); other.prop = r.something", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "hash" });
+      export const other = new Store({});
+      other.prop = r.something;
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"r" is an effect receipt');
+    expect(diags[0].message).toContain('"something"');
+  });
+
+  test("an alias of a receipt is still the receipt", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "existence" });
+      const alias = r;
+      export const svc = new Service({ tag: alias.name });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"alias"');
+  });
+
+  test("element access fires like property access", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r["effect"] });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"effect"');
+  });
+
+  test("namespaced factory call is recognized", () => {
+    const ctx = createContext(`
+      const r = chant.EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r.effect });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes: a receipt that nothing dereferences", () => {
+    const ctx = createContext(`
+      import { EffectReceipt } from "@intentius/chant";
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { schema: "v3" },
+      });
+      export const app = new Service({ image: "app:1" });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: referencing the receipt value itself (no attribute access)", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      registerReceipt(r);
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: property access on a non-receipt declarable", () => {
+    const ctx = createContext(`
+      export const db = new Database({ name: "main" });
+      export const app = new Service({ endpoint: db.endpoint });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("collectReceiptVariables resolves aliases declared before the receipt", () => {
+    const sf = ts.createSourceFile(
+      "t.ts",
+      `
+      const early = late;
+      const late = EffectReceipt("r", { effect: "e", flavor: "existence" });
+      `,
+      ts.ScriptTarget.Latest,
+      true,
+    );
+    const vars = collectReceiptVariables(sf);
+    expect(vars.has("late")).toBe(true);
+    expect(vars.has("early")).toBe(true);
+  });
+});

package/src/lint/rules/cor022-receipt-leaf.ts

@@ -0,0 +1,130 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+
+/**
+ * COR022: Effect Receipt Is a Leaf (#1833, epic #1703)
+ *
+ * Nothing may reference an effect receipt's attributes. A receipt is the
+ * declared witness that an out-of-band effect ran — the `effect()` step
+ * (#1834) is its sole writer, on success, last (../../effect-receipt.ts).
+ * Any resource that derives a property from a receipt couples itself to a
+ * value only the effect controls: the coupling is invisible at synthesis,
+ * and the receipt's late write (or its absence after a crash) would ripple
+ * into resources that were supposed to be independent of whether the effect
+ * has fired yet.
+ *
+ * The rule walks the file's reference graph the way COR011 does: it collects
+ * every variable initialized from an `EffectReceipt(...)` call (aliases
+ * included — `const alias = receipt` is still the receipt), then flags every
+ * property or element access rooted at one of them. Const indirection fires:
+ *
+ *   const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+ *   other.prop = r.something;   // COR022
+ *
+ * Referencing the receipt VALUE (passing `r` itself around) is not flagged —
+ * the leaf constraint is about attributes, and lexicon materialization rows
+ * legitimately take the whole declaration.
+ *
+ * Core recognizes the factory call by name; a lexicon-materialized receipt
+ * row (#1835) is recognized at build time by its marker instead — this rule
+ * is the source-level half.
+ */
+
+/** Simple callee name of a call: `EffectReceipt(...)` or `chant.EffectReceipt(...)`. */
+function calleeName(expr: ts.CallExpression): string | undefined {
+  if (ts.isIdentifier(expr.expression)) return expr.expression.text;
+  if (ts.isPropertyAccessExpression(expr.expression)) return expr.expression.name.text;
+  return undefined;
+}
+
+/** A variable declaration's `EffectReceipt(...)` initializer, if that is what it is. */
+export function receiptFactoryCall(decl: ts.VariableDeclaration): ts.CallExpression | undefined {
+  if (!decl.initializer || !ts.isCallExpression(decl.initializer)) return undefined;
+  return calleeName(decl.initializer) === "EffectReceipt" ? decl.initializer : undefined;
+}
+
+/**
+ * Every variable name bound to an effect receipt in this file: direct
+ * `EffectReceipt(...)` initializers plus identifier aliases, resolved to a
+ * fixpoint so declaration order does not matter. Scope-naive by design, the
+ * same trade COR011 makes — a chant source file is flat declarations.
+ */
+export function collectReceiptVariables(sourceFile: ts.SourceFile): Set<string> {
+  const receipts = new Set<string>();
+  const aliases: Array<[string, string]> = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      if (receiptFactoryCall(node)) {
+        receipts.add(node.name.text);
+      } else if (ts.isIdentifier(node.initializer)) {
+        aliases.push([node.name.text, node.initializer.text]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const [name, source] of aliases) {
+      if (receipts.has(source) && !receipts.has(name)) {
+        receipts.add(name);
+        grew = true;
+      }
+    }
+  }
+  return receipts;
+}
+
+/** The accessed attribute's name, for the message: `r.something` → "something". */
+function accessedAttribute(node: ts.PropertyAccessExpression | ts.ElementAccessExpression): string {
+  if (ts.isPropertyAccessExpression(node)) return node.name.text;
+  const arg = node.argumentExpression;
+  return ts.isStringLiteralLike(arg) ? arg.text : "<computed>";
+}
+
+export const cor022ReceiptLeafRule: LintRule = {
+  id: "COR022",
+  severity: "error",
+  category: "correctness",
+  description:
+    "An effect receipt is a leaf — nothing may reference its attributes; the effect() step is the receipt's sole writer",
+  check(context: LintContext): LintDiagnostic[] {
+    const receipts = collectReceiptVariables(context.sourceFile);
+    if (receipts.size === 0) return [];
+
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (
+        (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+        ts.isIdentifier(node.expression) &&
+        receipts.has(node.expression.text)
+      ) {
+        const receipt = node.expression.text;
+        const attribute = accessedAttribute(node);
+        const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+          node.getStart(context.sourceFile),
+        );
+        diagnostics.push({
+          file: context.filePath,
+          line: line + 1,
+          column: character + 1,
+          ruleId: "COR022",
+          severity: "error",
+          message:
+            `"${receipt}" is an effect receipt — a receipt is a leaf, and nothing may reference its ` +
+            `attributes ("${attribute}" here). The effect() step is the receipt's sole writer, so a ` +
+            `property derived from it couples this resource to a value only the effect controls. ` +
+            `Reference the effect's inputs (or the resources they come from) directly instead.`,
+        });
+      }
+      ts.forEachChild(node, visit);
+    }
+    visit(context.sourceFile);
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/cor024-receipt-secret-pointer.test.ts

@@ -0,0 +1,121 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("COR024: receipt inputs reference secrets by pointer (#1833)", () => {
+  test("rule metadata", () => {
+    expect(cor024ReceiptSecretPointerRule.id).toBe("COR024");
+    expect(cor024ReceiptSecretPointerRule.severity).toBe("error");
+    expect(cor024ReceiptSecretPointerRule.category).toBe("correctness");
+  });
+
+  test("flags a receipt input reading a Secret entity's data attribute", () => {
+    const ctx = createContext(`
+      export const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { password: dbSecret.data.password },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR024");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("dbSecret.data.password");
+    expect(diags[0].message).toContain("name+version pointer");
+    expect(diags[0].message).toContain("secretVersion");
+  });
+
+  test("flags a .value read on a Secret entity", () => {
+    const ctx = createContext(`
+      const apiToken = new ExternalSecret({ name: "api-token" });
+      export const bootstrapped = EffectReceipt("bootstrapped", {
+        effect: "bootstrap",
+        flavor: "hash",
+        inputs: { token: apiToken.value },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("apiToken.value");
+  });
+
+  test("const indirection fires: material extracted into a variable first", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      const material = dbSecret.data;
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { password: material.password },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("material");
+  });
+
+  test("bare material variable as an input fires", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      const material = dbSecret.stringData;
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { blob: material },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes: the name+version pointer form", () => {
+    const ctx = createContext(`
+      export const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { secretName: dbSecret.name, secretVersion: 3 },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: non-secret entity attributes and static inputs", () => {
+    const ctx = createContext(`
+      export const db = new Database({ name: "main" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { endpoint: db.endpoint, schema: "v3", value: db.port },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: secret material read OUTSIDE a receipt's inputs is not this rule's concern", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const app = new Service({ env: { DB_PASSWORD: dbSecret.data.password } });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("declareSecret provenance declarations are secret-rooted", () => {
+    const ctx = createContext(`
+      const dbSecret = declareSecret("db-password", { provenance: "referenced" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { v: dbSecret.value },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(1);
+  });
+});

package/src/lint/rules/cor024-receipt-secret-pointer.ts

@@ -0,0 +1,218 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+import { receiptFactoryCall } from "./cor022-receipt-leaf";
+
+/**
+ * COR024: Receipt Inputs Reference Secrets by Pointer (#1833, epic #1703;
+ * composes with the secret-provenance work, #1365/#1828)
+ *
+ * A receipt's `inputs` feed its expectation hash (../../effect-receipt.ts) —
+ * whatever lands there is canonicalized, digested, and compared against a
+ * stored value for the rest of the receipt's life. chant's constitutional
+ * line on secrets is that no code path may hold, log, hash, or compare a
+ * secret value (../../secret-provenance.ts), so a receipt input that reads a
+ * Secret-kind entity's material (`.data`, `.value`, `.stringData`, ...)
+ * violates it twice over: the material enters the hash, and the serialized
+ * placeholder ties the receipt to the secret's value rather than its
+ * identity.
+ *
+ * The pointer form is fine — and is the point: reference the secret by name
+ * and version (`{ secretName: dbSecret.name, secretVersion: 3 }`), so a
+ * rotation is an explicit version bump that re-proposes the effect, and the
+ * hash only ever sees the pointer.
+ *
+ * Recognition is the same file-local reference walk COR022 uses (const
+ * indirection included): a variable is Secret-kind when its initializer is a
+ * constructor or factory whose name says so (`new SecretManagerSecret(...)`,
+ * `new ExternalSecret(...)`, `declareSecret(...)`); an input fires when a
+ * property chain rooted at one of those crosses a material field.
+ */
+
+/** Fields that carry secret material. Mirrors secret-provenance.ts's
+ * FORBIDDEN_MATERIAL_FIELDS, plus the provider-attribute spellings
+ * (`secretString`/`secretValue`) a materialized secret exposes. */
+const MATERIAL_FIELDS = new Set([
+  "value",
+  "data",
+  "stringdata",
+  "material",
+  "plaintext",
+  "ciphertext",
+  "secretstring",
+  "secretvalue",
+]);
+
+function isMaterialField(name: string): boolean {
+  return MATERIAL_FIELDS.has(name.toLowerCase());
+}
+
+/** Simple name of a `new X(...)` / `X(...)` / `ns.X(...)` initializer. */
+function initializerName(init: ts.Expression): string | undefined {
+  if (!ts.isNewExpression(init) && !ts.isCallExpression(init)) return undefined;
+  const callee = init.expression;
+  if (ts.isIdentifier(callee)) return callee.text;
+  if (ts.isPropertyAccessExpression(callee)) return callee.name.text;
+  return undefined;
+}
+
+/** Does this constructor/factory name declare a Secret-kind entity? */
+function isSecretKindName(name: string): boolean {
+  return /secret/i.test(name) || name === "declareSecret";
+}
+
+/** One access chain: `sec.data.password` → root "sec", segments ["data","password"]. */
+function decomposeChain(
+  node: ts.Expression,
+): { root: string; segments: string[] } | undefined {
+  const segments: string[] = [];
+  let current: ts.Expression = node;
+  while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+    if (ts.isPropertyAccessExpression(current)) {
+      segments.unshift(current.name.text);
+    } else {
+      const arg = current.argumentExpression;
+      segments.unshift(ts.isStringLiteralLike(arg) ? arg.text : "<computed>");
+    }
+    current = current.expression;
+  }
+  if (!ts.isIdentifier(current)) return undefined;
+  return { root: current.text, segments };
+}
+
+interface SecretVars {
+  /** Variables holding a Secret-kind entity (or an alias of one). */
+  secretRooted: Set<string>;
+  /** Variables that already crossed a material field (`const m = sec.data`). */
+  material: Set<string>;
+}
+
+/** File-local Secret-kind variables, aliases and material extractions, to a fixpoint. */
+function collectSecretVariables(sourceFile: ts.SourceFile): SecretVars {
+  const secretRooted = new Set<string>();
+  const material = new Set<string>();
+  const derived: Array<{ name: string; root: string; crossesMaterial: boolean; isBareAlias: boolean }> = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      const init = node.initializer;
+      const ctorName = initializerName(init);
+      if (ctorName !== undefined && isSecretKindName(ctorName)) {
+        secretRooted.add(node.name.text);
+      } else if (ts.isIdentifier(init)) {
+        derived.push({ name: node.name.text, root: init.text, crossesMaterial: false, isBareAlias: true });
+      } else if (ts.isPropertyAccessExpression(init) || ts.isElementAccessExpression(init)) {
+        const chain = decomposeChain(init);
+        if (chain) {
+          derived.push({
+            name: node.name.text,
+            root: chain.root,
+            crossesMaterial: chain.segments.some(isMaterialField),
+            isBareAlias: false,
+          });
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const d of derived) {
+      const rootIsSecret = secretRooted.has(d.root);
+      const rootIsMaterial = material.has(d.root);
+      if (!rootIsSecret && !rootIsMaterial) continue;
+      const target = rootIsMaterial || d.crossesMaterial ? material : secretRooted;
+      if (d.isBareAlias && !d.crossesMaterial && rootIsSecret) {
+        if (!secretRooted.has(d.name)) {
+          secretRooted.add(d.name);
+          grew = true;
+        }
+      } else if (!target.has(d.name)) {
+        target.add(d.name);
+        grew = true;
+      }
+    }
+  }
+  return { secretRooted, material };
+}
+
+export const cor024ReceiptSecretPointerRule: LintRule = {
+  id: "COR024",
+  severity: "error",
+  category: "correctness",
+  description:
+    "A receipt's inputs may reference a secret only by name+version pointer, never by value — secret material must not enter the expectation hash",
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const secrets = collectSecretVariables(context.sourceFile);
+    if (secrets.secretRooted.size === 0 && secrets.material.size === 0) return diagnostics;
+
+    const report = (node: ts.Node, rendered: string, root: string): void => {
+      const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+        node.getStart(context.sourceFile),
+      );
+      diagnostics.push({
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "COR024",
+        severity: "error",
+        message:
+          `Receipt input reads secret material (${rendered}) from "${root}" — a receipt's inputs may ` +
+          `reference a secret only by name+version pointer, never by value: the inputs are hashed into ` +
+          `the receipt's expectation, and no chant code path may hash or compare secret material. ` +
+          `Use the pointer form instead, e.g. { secretName: ${root}.name, secretVersion: 3 } — ` +
+          `a rotation then re-proposes the effect through an explicit version bump.`,
+      });
+    };
+
+    const checkInputs = (inputs: ts.Expression): void => {
+      const visit = (node: ts.Node): void => {
+        if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+          const chain = decomposeChain(node);
+          if (chain) {
+            const rootMaterial = secrets.material.has(chain.root);
+            const crossesMaterial = chain.segments.some(isMaterialField);
+            if (rootMaterial || (secrets.secretRooted.has(chain.root) && crossesMaterial)) {
+              report(node, `\`${chain.root}.${chain.segments.join(".")}\``, chain.root);
+              return; // one diagnostic per chain, not one per link
+            }
+          }
+        } else if (ts.isIdentifier(node) && secrets.material.has(node.text)) {
+          const parent = node.parent;
+          const isChainBase =
+            (ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) &&
+            parent.expression === node;
+          const isKey = ts.isPropertyAssignment(parent) && parent.name === node;
+          if (!isChainBase && !isKey) report(node, `\`${node.text}\``, node.text);
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(inputs);
+    };
+
+    const walk = (node: ts.Node): void => {
+      if (ts.isVariableDeclaration(node)) {
+        const call = receiptFactoryCall(node);
+        const options = call?.arguments[1];
+        if (options && ts.isObjectLiteralExpression(options)) {
+          for (const prop of options.properties) {
+            if (
+              ts.isPropertyAssignment(prop) &&
+              (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
+              prop.name.text === "inputs"
+            ) {
+              checkInputs(prop.initializer);
+            }
+          }
+        }
+      }
+      ts.forEachChild(node, walk);
+    };
+    walk(context.sourceFile);
+
+    return diagnostics;
+  },
+};